HSTS & Encryption
Checks max-age, includeSubDomains, and preload readiness to prevent SSL stripping.
Free security headers audit
Enter a domain to inspect security headers from edge responses.
Try:
Public HTTP/HTTPS surfaces only. Private or local targets fail closed.
Hardened HTTP edge defenses.
Protects users, agents, and brand integrity from common browser-side injection and downgrade attacks.
Security scope boundaries
This audit does not perform invasive penetration testing, port scanning, or vulnerability exploitation.
DISCLOSURE
We check public HTTP header hygiene without touching application business logic.
Frequently Asked Questions
What happens if HSTS is missing?
Without HSTS, attackers on insecure Wi-Fi can downgrade HTTPS traffic to plain HTTP via SSL stripping attacks.
Why is nosniff critical?
X-Content-Type-Options: nosniff stops browsers from MIME-sniffing a response away from the declared content-type, blocking script execution disguised as images.
Can I test local servers?
No. To protect against SSRF, all private, loopback, and local network requests fail closed.